7ac7b42889e14cbd8c7cebe692566ca045d0034f9ff103fc3ef9c5e035dc594f

max time kernel
123s
max time network
151s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23/01/2024, 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

svchost_dump_SCY - Copy.exe
Size

5.2MB
MD5

5fd3d21a968f4b8a1577b5405ab1c36a
SHA1

710e5ab0fceb71b982b966c3a7406ebdf1d2aa82
SHA256

7ac7b42889e14cbd8c7cebe692566ca045d0034f9ff103fc3ef9c5e035dc594f
SHA512

085a31c0412ba0a3d612a66ec8d95ce900e148240f92f9ec8c4d07b6c8e32cf233e92aefc7b4b53a91f5eacacd1cf3a8fcdf8cd7c206afa46014a9e4a9ddf53f
SSDEEP

98304:jgoX+R+gW1CkQFBAFGspWvuL136BRiGQiiyBrDbnh57cpbJLyns:coXxFGWL56BVrDbn77cjIs

Score

10^/10

evasion trojan

Malware Config

Signatures

Detects BazaLoader malware 9 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral1/memory/2060-0-0x0000000140000000-0x0000000140636000-memory.dmp	BazaLoader
behavioral1/files/0x00140000000185e9-32.dat	BazaLoader
behavioral1/memory/2044-35-0x0000000140000000-0x0000000140636000-memory.dmp	BazaLoader
behavioral1/memory/2060-33-0x0000000140000000-0x0000000140636000-memory.dmp	BazaLoader
behavioral1/files/0x00140000000185e9-30.dat	BazaLoader
behavioral1/files/0x00140000000185e9-27.dat	BazaLoader
behavioral1/files/0x00140000000185e9-26.dat	BazaLoader
behavioral1/memory/2060-37-0x0000000140000000-0x0000000140636000-memory.dmp	BazaLoader
behavioral1/memory/2044-80-0x0000000140000000-0x0000000140636000-memory.dmp	BazaLoader

Modifies Windows Firewall 1 TTPs 4 IoCs

evasion

Windows Service

T1543.003

pid	Process
2640	netsh.exe
2876	netsh.exe
1964	netsh.exe
1928	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
2044	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
2060	svchost_dump_SCY - Copy.exe
2060	svchost_dump_SCY - Copy.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System\xxx1.bak	svchost_dump_SCY - Copy.exe
File created	C:\Windows\System\svchost.exe	svchost_dump_SCY - Copy.exe
File opened for modification	C:\Windows\System\svchost.exe	svchost_dump_SCY - Copy.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2756	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3040	powershell.exe
2612	powershell.exe
2060	svchost_dump_SCY - Copy.exe
1624	powershell.exe
108	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3036	WMIC.exe
Token: SeSecurityPrivilege	3036	WMIC.exe
Token: SeTakeOwnershipPrivilege	3036	WMIC.exe
Token: SeLoadDriverPrivilege	3036	WMIC.exe
Token: SeSystemProfilePrivilege	3036	WMIC.exe
Token: SeSystemtimePrivilege	3036	WMIC.exe
Token: SeProfSingleProcessPrivilege	3036	WMIC.exe
Token: SeIncBasePriorityPrivilege	3036	WMIC.exe
Token: SeCreatePagefilePrivilege	3036	WMIC.exe
Token: SeBackupPrivilege	3036	WMIC.exe
Token: SeRestorePrivilege	3036	WMIC.exe
Token: SeShutdownPrivilege	3036	WMIC.exe
Token: SeDebugPrivilege	3036	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3036	WMIC.exe
Token: SeRemoteShutdownPrivilege	3036	WMIC.exe
Token: SeUndockPrivilege	3036	WMIC.exe
Token: SeManageVolumePrivilege	3036	WMIC.exe
Token: 33	3036	WMIC.exe
Token: 34	3036	WMIC.exe
Token: 35	3036	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3036	WMIC.exe
Token: SeSecurityPrivilege	3036	WMIC.exe
Token: SeTakeOwnershipPrivilege	3036	WMIC.exe
Token: SeLoadDriverPrivilege	3036	WMIC.exe
Token: SeSystemProfilePrivilege	3036	WMIC.exe
Token: SeSystemtimePrivilege	3036	WMIC.exe
Token: SeProfSingleProcessPrivilege	3036	WMIC.exe
Token: SeIncBasePriorityPrivilege	3036	WMIC.exe
Token: SeCreatePagefilePrivilege	3036	WMIC.exe
Token: SeBackupPrivilege	3036	WMIC.exe
Token: SeRestorePrivilege	3036	WMIC.exe
Token: SeShutdownPrivilege	3036	WMIC.exe
Token: SeDebugPrivilege	3036	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3036	WMIC.exe
Token: SeRemoteShutdownPrivilege	3036	WMIC.exe
Token: SeUndockPrivilege	3036	WMIC.exe
Token: SeManageVolumePrivilege	3036	WMIC.exe
Token: 33	3036	WMIC.exe
Token: 34	3036	WMIC.exe
Token: 35	3036	WMIC.exe
Token: SeDebugPrivilege	3040	powershell.exe
Token: SeDebugPrivilege	2612	powershell.exe
Token: SeIncreaseQuotaPrivilege	1680	WMIC.exe
Token: SeSecurityPrivilege	1680	WMIC.exe
Token: SeTakeOwnershipPrivilege	1680	WMIC.exe
Token: SeLoadDriverPrivilege	1680	WMIC.exe
Token: SeSystemProfilePrivilege	1680	WMIC.exe
Token: SeSystemtimePrivilege	1680	WMIC.exe
Token: SeProfSingleProcessPrivilege	1680	WMIC.exe
Token: SeIncBasePriorityPrivilege	1680	WMIC.exe
Token: SeCreatePagefilePrivilege	1680	WMIC.exe
Token: SeBackupPrivilege	1680	WMIC.exe
Token: SeRestorePrivilege	1680	WMIC.exe
Token: SeShutdownPrivilege	1680	WMIC.exe
Token: SeDebugPrivilege	1680	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1680	WMIC.exe
Token: SeRemoteShutdownPrivilege	1680	WMIC.exe
Token: SeUndockPrivilege	1680	WMIC.exe
Token: SeManageVolumePrivilege	1680	WMIC.exe
Token: 33	1680	WMIC.exe
Token: 34	1680	WMIC.exe
Token: 35	1680	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1680	WMIC.exe
Token: SeSecurityPrivilege	1680	WMIC.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 3036	2060	svchost_dump_SCY - Copy.exe	29
PID 2060 wrote to memory of 3036	2060	svchost_dump_SCY - Copy.exe	29
PID 2060 wrote to memory of 3036	2060	svchost_dump_SCY - Copy.exe	29
PID 2060 wrote to memory of 2640	2060	svchost_dump_SCY - Copy.exe	31
PID 2060 wrote to memory of 2640	2060	svchost_dump_SCY - Copy.exe	31
PID 2060 wrote to memory of 2640	2060	svchost_dump_SCY - Copy.exe	31
PID 2060 wrote to memory of 2876	2060	svchost_dump_SCY - Copy.exe	33
PID 2060 wrote to memory of 2876	2060	svchost_dump_SCY - Copy.exe	33
PID 2060 wrote to memory of 2876	2060	svchost_dump_SCY - Copy.exe	33
PID 2060 wrote to memory of 3040	2060	svchost_dump_SCY - Copy.exe	35
PID 2060 wrote to memory of 3040	2060	svchost_dump_SCY - Copy.exe	35
PID 2060 wrote to memory of 3040	2060	svchost_dump_SCY - Copy.exe	35
PID 2060 wrote to memory of 2612	2060	svchost_dump_SCY - Copy.exe	37
PID 2060 wrote to memory of 2612	2060	svchost_dump_SCY - Copy.exe	37
PID 2060 wrote to memory of 2612	2060	svchost_dump_SCY - Copy.exe	37
PID 2060 wrote to memory of 1468	2060	svchost_dump_SCY - Copy.exe	40
PID 2060 wrote to memory of 1468	2060	svchost_dump_SCY - Copy.exe	40
PID 2060 wrote to memory of 1468	2060	svchost_dump_SCY - Copy.exe	40
PID 2060 wrote to memory of 2756	2060	svchost_dump_SCY - Copy.exe	42
PID 2060 wrote to memory of 2756	2060	svchost_dump_SCY - Copy.exe	42
PID 2060 wrote to memory of 2756	2060	svchost_dump_SCY - Copy.exe	42
PID 2060 wrote to memory of 2044	2060	svchost_dump_SCY - Copy.exe	45
PID 2060 wrote to memory of 2044	2060	svchost_dump_SCY - Copy.exe	45
PID 2060 wrote to memory of 2044	2060	svchost_dump_SCY - Copy.exe	45
PID 2044 wrote to memory of 1680	2044	svchost.exe	44
PID 2044 wrote to memory of 1680	2044	svchost.exe	44
PID 2044 wrote to memory of 1680	2044	svchost.exe	44
PID 2044 wrote to memory of 1964	2044	svchost.exe	48
PID 2044 wrote to memory of 1964	2044	svchost.exe	48
PID 2044 wrote to memory of 1964	2044	svchost.exe	48
PID 2044 wrote to memory of 1928	2044	svchost.exe	52
PID 2044 wrote to memory of 1928	2044	svchost.exe	52
PID 2044 wrote to memory of 1928	2044	svchost.exe	52
PID 2044 wrote to memory of 1624	2044	svchost.exe	50
PID 2044 wrote to memory of 1624	2044	svchost.exe	50
PID 2044 wrote to memory of 1624	2044	svchost.exe	50
PID 2044 wrote to memory of 108	2044	svchost.exe	53
PID 2044 wrote to memory of 108	2044	svchost.exe	53
PID 2044 wrote to memory of 108	2044	svchost.exe	53

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\svchost_dump_SCY - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\svchost_dump_SCY - Copy.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3036
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:2640
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:2876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2612
- C:\Windows\system32\schtasks.exe
  schtasks /delete /TN "Timer"
  2⤵
  PID:1468
- C:\Windows\system32\schtasks.exe
  schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
  2⤵
  - Creates scheduled task(s)
  PID:2756
- C:\Windows\System\svchost.exe
  "C:\Windows\System\svchost.exe" formal
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:1964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1624
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:1928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:108

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
75ef91188e430aba34e5427bf534618f

SHA1
830c3d29594eae456d259e193ae47aa045b9486f

SHA256
838a7d955be4fbf5466b0c184b5021c3f6791bc57253c2e00f785768ba5b0bb0

SHA512
d5cb95b842ae57cb81ebfbfb530edbd281d068e1334d663bb7f83492eca4b59811d17fa4b2cb291d512d95f7ba6b67dadf93cdb6ebdad50eb658a0a772d39494

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp

Filesize
2.7MB

MD5
1a54941e69d95e9a46d184486f32ff9f

SHA1
fa94366a0032895f00742ef06e5663c888245847

SHA256
2553820f11ff6d383401860b42b7ce8168950d72a9cef7434dfd4b372f0a10da

SHA512
ddbdefd03d9d669c4e958542be9b87ed05c83289c17f4364858b4d412c7d91946d0b1f97e9279edded849d012b2e8bbc9db8af32bf32a22d8466d7caf253727b

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new

Filesize
2.5MB

MD5
1528f0ebb080f1b74256588e8524a332

SHA1
38070f730d23adf9610abdc9a3e0b13277b12b38

SHA256
1e8e3f8d734f0231e66712969a4085524282d963a63c4c640fbcd18efee3f74c

SHA512
578df244868090ef96ab6f6482e36ab1d960385ccbbbbf2b42ee2e59e020f3008a7ab36e4b5bb8dd9859bf31b3a35d7644254e80165b14112048c5992c03dfd0

Download Submit
C:\Windows\system\svchost.exe

Filesize
236KB

MD5
2aecbf1749a77caa002df331f00e089d

SHA1
af2d9e19d3956b04d8324b090747803e86331820

SHA256
5a2cf0f6f7db237679324b1b6156a11a367d60d17a81a8abfd57707adc801d57

SHA512
0ea13eb2902ccc39c26c927d4ae7a7cb4dde1566ee3de0691798948e078beef464228dcdb8c972bf0b9f7e1845ec3fd92473f04cbec0f41f5feba8f0a0a4bf71

Download Submit
C:\Windows\system\svchost.exe

Filesize
53KB

MD5
44a18a591accd89ac012ac1d48c6e367

SHA1
a4d2988e1504f13661682aeca813c96f7b6a0109

SHA256
f9886644101c4967d410231a961843d35818d1086e105f6672a8e8107ce1e0a9

SHA512
10473e286fa6300c6a096b5e726cae00c409e30d59fd7fa7c40a71786c197a92164c97fc4b7295eb61839a030711c96d1797b140320e1d79dd8d45a901c4ecfa

Download Submit
\Windows\system\svchost.exe

Filesize
152KB

MD5
86a73dd116657cbd0c6ad815d48beea8

SHA1
c11f9269f9465a388459caa9d5a83b18294a199e

SHA256
d9d1b0d7191ee2be4a8d6a5689eadc1250bebe80f539652063ec31d8c832d505

SHA512
efdae5eb03afd622b3cf118e778413dded0355b3241da6008ebc2e86ebf44e2e4eed12c236758396b36593981fb093890802e77c492cd3e381c8520cfbad0fa6

Download Submit
\Windows\system\svchost.exe

Filesize
292KB

MD5
3fec225f8cdd4f87a721aafd61ebbd79

SHA1
63e6834ca1f8c8de94d2c28a88ea94ea45c2fa38

SHA256
eba7bf216f5728981e0cb3abb15deffdbe1a36da72085e3fc48d4a302ca553af

SHA512
0a8d10f8c5fa4c555523467011a678f4e09e7820a5e7f342845015f2009e47e2807afec0d02316e9fbf680fb2a530a6e286fcf71f42247a62bce8d962ef5aa96

Download Submit
memory/108-63-0x0000000002C80000-0x0000000002D00000-memory.dmp

Filesize
512KB

Download
memory/108-57-0x0000000002C80000-0x0000000002D00000-memory.dmp

Filesize
512KB

Download
memory/108-55-0x0000000002C80000-0x0000000002D00000-memory.dmp

Filesize
512KB

Download
memory/108-58-0x0000000002C80000-0x0000000002D00000-memory.dmp

Filesize
512KB

Download
memory/108-64-0x000007FEF4D90000-0x000007FEF572D000-memory.dmp

Filesize
9.6MB

Download
memory/108-60-0x000007FEF4D90000-0x000007FEF572D000-memory.dmp

Filesize
9.6MB

Download
memory/108-56-0x000007FEF4D90000-0x000007FEF572D000-memory.dmp

Filesize
9.6MB

Download
memory/1624-59-0x0000000002964000-0x0000000002967000-memory.dmp

Filesize
12KB

Download
memory/1624-47-0x0000000002960000-0x00000000029E0000-memory.dmp

Filesize
512KB

Download
memory/1624-61-0x000007FEF4D90000-0x000007FEF572D000-memory.dmp

Filesize
9.6MB

Download
memory/1624-53-0x0000000002960000-0x00000000029E0000-memory.dmp

Filesize
512KB

Download
memory/1624-45-0x0000000002890000-0x0000000002898000-memory.dmp

Filesize
32KB

Download
memory/1624-48-0x000007FEF4D90000-0x000007FEF572D000-memory.dmp

Filesize
9.6MB

Download
memory/1624-46-0x000007FEF4D90000-0x000007FEF572D000-memory.dmp

Filesize
9.6MB

Download
memory/1624-44-0x000000001B5B0000-0x000000001B892000-memory.dmp

Filesize
2.9MB

Download
memory/1624-62-0x000000000296B000-0x00000000029D2000-memory.dmp

Filesize
412KB

Download
memory/2044-35-0x0000000140000000-0x0000000140636000-memory.dmp

Filesize
6.2MB

Download
memory/2044-80-0x0000000140000000-0x0000000140636000-memory.dmp

Filesize
6.2MB

Download
memory/2044-65-0x000000001ECF0000-0x000000001F1D2000-memory.dmp

Filesize
4.9MB

Download
memory/2060-33-0x0000000140000000-0x0000000140636000-memory.dmp

Filesize
6.2MB

Download
memory/2060-37-0x0000000140000000-0x0000000140636000-memory.dmp

Filesize
6.2MB

Download
memory/2060-0-0x0000000140000000-0x0000000140636000-memory.dmp

Filesize
6.2MB

Download
memory/2060-36-0x0000000040AF0000-0x0000000041126000-memory.dmp

Filesize
6.2MB

Download
memory/2060-34-0x0000000040AF0000-0x0000000041126000-memory.dmp

Filesize
6.2MB

Download
memory/2612-23-0x0000000002D30000-0x0000000002DB0000-memory.dmp

Filesize
512KB

Download
memory/2612-20-0x000007FEF4100000-0x000007FEF4A9D000-memory.dmp

Filesize
9.6MB

Download
memory/2612-19-0x0000000002D30000-0x0000000002DB0000-memory.dmp

Filesize
512KB

Download
memory/2612-21-0x000007FEF4100000-0x000007FEF4A9D000-memory.dmp

Filesize
9.6MB

Download
memory/2612-17-0x000007FEF4100000-0x000007FEF4A9D000-memory.dmp

Filesize
9.6MB

Download
memory/2612-22-0x0000000002D3B000-0x0000000002DA2000-memory.dmp

Filesize
412KB

Download
memory/3040-18-0x000007FEF4100000-0x000007FEF4A9D000-memory.dmp

Filesize
9.6MB

Download
memory/3040-15-0x000007FEF4100000-0x000007FEF4A9D000-memory.dmp

Filesize
9.6MB

Download
memory/3040-13-0x0000000002950000-0x00000000029D0000-memory.dmp

Filesize
512KB

Download
memory/3040-12-0x000007FEF4100000-0x000007FEF4A9D000-memory.dmp

Filesize
9.6MB

Download
memory/3040-16-0x000000000295B000-0x00000000029C2000-memory.dmp

Filesize
412KB

Download
memory/3040-14-0x0000000002954000-0x0000000002957000-memory.dmp

Filesize
12KB

Download
memory/3040-6-0x0000000002A10000-0x0000000002A18000-memory.dmp

Filesize
32KB

Download
memory/3040-5-0x000000001B500000-0x000000001B7E2000-memory.dmp

Filesize
2.9MB

Download